AMENDMENTS TO THE CLAIMS 

1 . (Currently Amended) An anti-virus system for an electronic mail message, the system 
including comprising: 

detecting means for determining the presence of the electronic mail message , wherein the 
electronic mail message includes at least one message text ; 

analysis and scanning means for: analysing (i) analyzing and scanning the e l e ctronic mail 
m e ssag e message text for script tags indicating that indicate the presence of operable program 
code, and for £ii] removing any such script tags and operable program code from the e l e ctronic 
mail m e ssag e message text, regardless of whether the script tags and operable program code are 
associated with a known virus; and without scanning the el e ctronic mail m e ssag e for strings of 
charact e rs which are known to b e included in known virus e s; and 

application means for applying the electronic mail message, with the script tags and 
operable program code removed from the message text , to server means. 

2. (Currently Amended) [[An]] The anti-virus system as claimed in claim 1, wherein the 
electronic mail message further includes at least one attachment, 

wherein the detecting means for determining the presence of the electronic mail message 
includ e s further comprise decomposition means for breaking the electronic mail message into 
constitu e nt bodi e s or m e ssage texts and attachments of th e e l e ctronic m e ssag e ; at least the 
message text and attachment, 

wherein the analysis and scanning means comprise scanning means for scanning each of 
the constitu e nt bodi e s and attachm e nts the message text and attachment, and 
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wherein the application means for applying the electronic mail message^ with the script 
tags and operable program code removed from the message text, to server means includes 
recomposition means for rebuilding the electronic mail message from th e constituent bodies and 
attachm e nts the message text and attachment . 

3. (Currently Amended) [[An]] The anti-virus system as claimed in claim 1, wherein the 
analysis and scanning means compris e scanning m e ans for scanning th e messag e for script tags 
comprising comprise predetermined character strings. 

4. (Currently Amended) [[An]] The anti-virus system as claimed in claim 1, wherein the 
application means for applying the electronic mail message^ with the script tags arid operable 
program code removed from the message text, to server means includ e s comprise replacement 
means for replacing the removed script tag tags and operable program code with alternative text. 

5. (Currently Amended) [[An]] The anti- virus system as claimed in claim 4, wherein the 
r e plac e ment m e ans is adapt e d to r e place with alternative text for informing informs a recipient of 
the electronic mail message that operable program code has been removed. 

6. (Currently Amended) [[An]] The anti-virus system as claimed in claim 2, wherein the 
analysis and scanning means include scanning means for scanning one or more attachments for 
operable macros. 

McDonnell Boehnen Hulbert & Berg ho ff LLP 3 

300 South Wacker Drive 
Chicago, Illinois 60606 
Telephone: (312)913-0001 
Facsimile: (312)913-0002 



7. (Currently Amended) [[An]] The anti-virus system as claimed in claim 2, wherein the 
system further comprises quarantine means for at least one of: (0 quarantining a constitu e nt body 
message text containing operable program code, and/or and (ii) removing from the electronic 
mail message and quarantining an attachment containing a macro or operable program code. 

8. (Currently Amended) [[An]] The anti-virus system as claimed in claim 7, wherein the 
quarantine means includ e s further comprise means for removing a macro from an the attachment 
containing a macro or operable program code , quarantining the macro L and releasing the 
attachment with the macro removed. 

9. (Currently Amended) [[An]] The anti-virus system as claimed in claim 7, wherein the 
quarantine means includes further comprise means for storing th e constitu e nt body, one of the 
attachment ef and macro in a quarantine storage location as a quarantined item; 

receiving means for receiving a an input indicating a decision wh e th e r to deliver the 
quarantined item may b e d e liv e red to an intended recipient; and 

d e pendant on responsive to the decision input eithe r, one of : (i) releasing the quarantined 
item with the operable code removed from the quarantined item, for delivery to the an intended 
recipient with or without th e op e rabl e cod e r e mov e d , and (ii) releasing the quarantined item with 
the operable code included in the quarantined item, for delivery to the intended recipient er and 
(ni) deleting the quarantined item. 
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10. (Currently Amended) [[An]] The anti-virus system as claimed in claim 7, wherein the 
quarantine means includ e s further comprise informing means , on del e ting th e quarantin e d it e m, 
iov 2 responsive to deleting the quarantined item, informing the at least one of an intended 
recipient and/or and a sender of the message that the quarantined item has been deleted without 
being delivered to the intended recipient. 

11. (Currently Amended) [[An]] The anti-virus system as claimed in claim 6, wherein the 
scanning means for scanning one or more attachments for operable macros compris e s further 
comprise means for sequentially scanning the one or more attachments for a plurality of 
predetermined character strings indicative of a macro. 

12. (Currently Amended) [[An]] The anti-virus system as claimed in claim 11, wherein 
the means for scanning one or more attachments for a plurality of predetermined character strings 
includ e s further comprise termination means for terminating scanning when one of the plurality 
of predetermined strings is not found on completely scanning the one or more attachments. 

13. (Currently Amended) [[An]] The anti-virus system as claimed in claim 1, wherein the 
detecting means for determining the presence of the electronic mail message is adapt e d to capture 
further comprise capturing one or more electronic mail messages passing between a first network 
and a second network. 
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14. (Currently Amended) [[An]] The anti-virus system as claimed in claim 13, wherein 
the detecting means for determining the presence of the electronic mail message is adapt e d to 
captur e further comprise capturing one or more electronic mail messages passing between an 
internal or private network and an external or public network. 

15. (Currently Amended) A method of r e moving a virus from providing anti-virus 
protection for an electronic mail message including th e st e ps of , wherein the electronic mail 
message comprises at least one message text, the method comprising: 

(a) capturing the electronic mail message; 

(b) scanning the message text for script tags indicating that indicate the presence of 
operable program code; 

(c) removing the script tags and operable program code from the el e ctronic mail message 
text, regardless of whether the script tags and operable program code are associated with a known 
virus; and; without scanning th e e l e ctronic mail m e ssag e for strings of characters which ar e 
known to b e includ e d in known virus e s; and 

(d) releasing the electronic mail message^ with the script tags and operable program code 
removed from the message text . 

16. (Currently Amended) [[A]] The method as claimed in claim 15, wherein [[the]] step 
(c) comprising comprises quarantining a the electronic mail message or a part portion of a the 
electronic mail message containing operable program code. 
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17. (Currently Amended) [[A]] The method as claimed in claim 15, wherein the 
electronic mail message further includes at least one attachment, wherein step (a) includ e s th e 
step of br e aking further comprises dividing the electronic mail message into constitu e nt bodi e s at 
least the message text and attachment or m e ssag e t e xts and attachm e nts of th e e l e ctronic 
m e ssag e ; A 

wherein step (b) further comprises scanning the constitu e nt bodi e s and attachm e nts 
message text and attachment, and 

wherein step (d) includ e s the st e p of further comprises rebuilding the electronic mail 
message from th e constitu e nt bodi e s and attachm e nts at least the message text and attachment . 

18. (Currently Amended) [[A]] The method as claimed in claim 15, wherein st e p (b) 
furth e r compris e s scanning th e m e ssag e for the script tags comprising comprise predetermined 
character strings. 

19. (Currently Amended) [[A]] The method as claimed in claim 15, wherein step (c) 
includ e s further comprises replacing the removed script tag tags and operable program code with 
alternative text. 

20. (Currently Amended) [[A]] The method as claimed in claim 19, wherein the s t e p of 
r e placing th e r e moved script tag and op e rabl e cod e with alt e rnativ e t e xt compris e s using 
alternative text for informing informs a recipient of the electronic mail message that operable 
program code has been removed. 

McDonnell Boehnen Hulbert & Berghoff LLP 7 

300 South Wacker Drive 
Chicago, Illinois 60606 
Telephone: (312)913-0001 
Facsimile: (312)913-0002 



21. (Currently Amended) [[A]] The method as claimed in claim 17, wherein step (b) 
includ e s further comprises scanning one or more attachments for op e rabl e macros^ and wherein 
step (c) further comprises , responsive to finding a macro: [[,]](!} removing from the electronic 
mail message the macro, and (n) quarantining at least one of the macro any macros and/or and 
the attachment any attachm e nts containing the macro macros . 

22. (Currently Amended) [[A]] The method as claimed in claim 16, wherein th e step of 
quarantining a the electronic mail message or a part portion of a the electronic mail message 
comprises th e st e ps of : 

storing a constitu e nt body, attachm e nt or macro of the electronic mail message of the 
portion of the electronic mail message in a quarantine storage location as a quarantined item; 

receiving a decision whether the quarantined item may be delivered to an intended 
recipient; and 

dep e ndant on responsive to receiving the decision^ e ither one of: (i) releasing the 
quarantined item for d e livery, with or without the operable code or macro deleted from the 
quarantined item , for delivery to the an intended recipient, (ii) releasing the quarantined item 
with the operable code included in the quarantined item, for delivery to the intended recipient, or 
and (iii) deleting the quarantined item. 

23. (Currently Amended) [[A]] The method as claimed in claim 22, wherein th e step of 
deleting the quarantined item includes further comprises informing at least one of the intended 
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recipient and/or and a sender of the message that the quarantined item has been deleted without 
being delivered to the intended recipient. 

24. (Currently Amended) [[A]] The method as claimed in claim 21, wherein the st e p of 
scanning attachments for op e rable macros includ e s step (b) further comprises sequentially 
scanning the one or more attachments for a plurality of predetermined character strings indicative 
of a macro. 

25. (Currently Amended) [[A]] The method as claimed in claim 24, wherein th e st e p of 
scanning attachm e nts for a plurality of predet e rmined charact e r strings is t e rminated step (b) 
further comprises terminating when one of the plurality of predetermined strings is not found eft 
compl e t e ly scanning in the attachment. 

26. (Currently Amended) [[A]] The method as claimed in claim 15, wherein step (a) 
comprises capturing the electronic mail message m e ssag e s passing between a first network and a 
second network. 

27. (Currently Amended) [[A]] The method as claimed in claim 26, wherein step (a) 
comprises capturing the electronic mail message m e ssag e s passing between an internal or private 
network and an external or public network. 
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28. (Previously Presented) A computer program comprising code means for performing 
all the steps of the method of claim 1 5 when the program is run on one or more computers. 

29. (Currently Amended) [[A]] The computer program as claimed in claim 28, wherein 
the computer program is embodied on a computer-readable medium. 

30. (Previously Presented) A computer program product comprising program code means 
stored in a computer-readable medium for performing the method of claim 15, when that 
program product is run on one or more computers. 

3 1 . (New) The anti-virus system as claimed in claim 1 , wherein the electronic mail 
message further includes at least one attachment, the system further comprising: 

decomposition means for dividing the electronic mail message into at least the message 
text and attachment; 

analysis and scanning means for: (i) analyzing and scanning the attachment for a macro, 
and (ii) regardless of whether the macro is associated with a known virus, at least one of: (a) 
deleting the attachment, (b) quarantining the attachment, (c) removing any such macro from the 
attachment and quarantining the macro, and (d) removing any such macro from the attachment 
and deleting the macro. 
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32. (New) The anti-virus system as claimed in claim 31, further comprising 
reassembling means for reassembling the electronic mail message from at least the message text 
and attachment, with the macro removed from the attachment. 

33. (New) The method as claimed in claim 15, wherein the electronic mail message 
further includes at least one attachment, the method further comprising: 

scanning the attachment for one or more macros; and 

regardless of whether a macro is associated with a known virus, at least one of: (a) 
deleting the attachment, (b) quarantining the attachment, (c) removing any such macro from the 
attachment and quarantining the macro, and (d) removing any such macro from the attachment 
and deleting the macro. 

34. (New) The method as claimed in claim 33, further comprising reassembling the 
electronic mail message from at least the message text and attachment, with the macro removed 
from the attachment. 

35. (New) The anti-virus system of claim 9, further comprising storage means for 
storing a list of persons authorized to approve a quarantined item, wherein receiving means for 
receiving an input indicating a decision further comprises receiving the decision from a person 
that is included on the stored list of authorized persons. 
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36. (New) The method as claimed in claim 22, further comprising storing a list of 
persons authorized to approve quarantined items, wherein receiving a decision whether the 
quarantined item may be delivered to an intended recipient further comprises receiving the 
decision from a person that is included in the stored list of authorized persons. 
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